summaryrefslogtreecommitdiff
path: root/sys/netinet/in_pcb.c
AgeCommit message (Collapse)Author
2016-03-23Merge in_pcbbind() and in6_pcbbind(), and change every call toVincent Gross
in6_pcbbind() into in_pcbbind(). Ok jca@ mpi@
2016-03-23Extract in_pcbaddrisavail() from in_pcbbind().Vincent Gross
ok jca@
2015-12-18Fix SO_REUSE* flags effects when binding multicast addresses. NoVincent Gross
regression observed on avahi. ok benno@
2015-12-03Get rid of rt_mask() and stop allocating a "struct sockaddr" for everyMartin Pieuchot
route entry in ART. rt_plen() now represents the prefix length of a route entry and should be used instead. For now use a "struct sockaddr_in6" to represent the mask when needed, this should be then replaced by the prefix length and RTA_NETMASK only used for compatibility with userland. ok claudio@
2015-12-03Remove broadcast matching from ifa_ifwithaddr(), use in_broadcast() whereVincent Gross
required. ok bluhm@ mpi@.
2015-12-03To avoid that the stack manipules the pf statekeys directly, introduceAlexander Bluhm
pf_inp_...() lookup, link and unlink functions as an interface. Locking can be added to them later. Remove the first linking at the beginning of tcp_input() and udp_input() as it is not necessary. It will be done later anyway. That code was a relict, from the time before I had added the second linking. Input from mikeb@ and sashan@; OK sashan@
2015-12-03Rename pf_unlink_state() to pf_remove_state() so the name does notAlexander Bluhm
collide with the statekey to inp unlinking. OK sashan@ mpi@
2015-12-02Move port picking away from in_pcbbind()Vincent Gross
ok sthen@
2015-12-02- hide PF internals to pf_unlink_divert_state() from in_pcb.cAlexandr Nedvedicky
OK mpi@, bluhm@
2015-10-30Rename rtrequest1() to rtrequest().Alexander Bluhm
OK mpi@
2015-10-25Instead of doing the the if_get() dance for rt_missmsg(), change theAlexander Bluhm
function to take an interface index. discussed with mpi@; OK claudio@
2015-10-23``rt_ifp'' cannot be NULL.Martin Pieuchot
ok claudio@
2015-10-20At guenther's suggestion replace dnssocket() with a SOCK_DNS flag onTheo de Raadt
socket(). Without pledge, all other socket behaviours become permitted, except this one case: connect/send* only works to *:53. In pledge mode, a very few are further restricted. Some backwards compatibility for the dnssocket/dnsconnect calls will remain in the tree temporarily so that people can build through the transition. ok tedu guenther semarie
2015-10-19Stop checking for RTF_UP directly, call rtisvalid(9) instead.Martin Pieuchot
While here add a missing ``rtableid'' check in in_selectsrc(). ok bluhm@
2015-10-19deduplicate in[6]_pcbbind() port scan loop.Vincent Gross
ok mpi@
2015-10-18Add two new system calls: dnssocket() and dnsconnect(). This creates aTheo de Raadt
SS_DNS tagged socket which has limited functionality (for example, you cannot accept on them...) The libc resolver will switch to using these, therefore pledge can identify a DNS transaction better. ok tedu guenther kettenis beck and others
2015-10-09Rename tame() to pledge(). This fairly interface has evolved to be moreTheo de Raadt
strict than anticipated. It allows a programmer to pledge/promise/covenant that their program will operate within an easily defined subset of the Unix environment, or it pays the price.
2015-09-22Remove inpt_lastport from struct inpcbtable, use local variablesVincent Gross
in in_pcbbind() and in6_pcbsetport() ok claudio@, with input from David Hill
2015-09-11Convert _TM_ flags to TAME_ flags, collapsing the entire mappingTheo de Raadt
layer because the strings select the right options. Mechanical conversion. ok guenther
2015-09-11Stricter checks on sockaddr content when binding PF_INET sockets.Vincent Gross
Ok mpi@
2015-09-11Only include <sys/tame.h> in the .c files that need itPhilip Guenther
ok deraadt@ miod@
2015-09-09if_put after you if_getDavid Gwynne
ok mpi@
2015-09-01Replace sockaddr casts with the proper satosin(), ... calls.Alexander Bluhm
From David Hill; OK mpi@; tested kspillner@; tweaks bluhm@
2015-08-22Move to tame(int flags, char *paths[]) API/ABI.Theo de Raadt
The pathlist is a whitelist of dirs and files; anything else returns ENOENT. Recommendation is to use a narrowly defined list. Also add TAME_FATTR, which permits explicit change operations against "struct stat" fields. Some other TAME_ flags are refined slightly. Not cranking libc now, since nothing commited in base uses this and the timing is uncomfortable for others. Discussed with many; thanks for a few bug fixes from semarie, doug, guenther. ok guenther
2015-08-19Convert all calls to rtrequest1() and the following error checkAlexander Bluhm
into a common pattern. In the man page clarify the usage of the returned route. OK mpi@ mikeb@ jmc@
2015-07-19tame(2) is a subsystem which restricts programs into a "reduced featureTheo de Raadt
operating model". This is the kernel component; various changes should proceed in-tree for a while before userland programs start using it. ok miod, discussions and help from many
2015-07-15m_freem() can handle NULL, do not check for this condition beforehands.Theo de Raadt
ok stsp mpi
2015-04-16remove unfinished/unused support for socket-attached ipsec-policiesMarkus Friedl
ok mikeb
2015-04-14Remove support for storing credentials and auth information in the kernel.Mike Belopuhov
This code is largely unfinished and is not used for anything. The change leaves identities as only objects referenced by ipsec_ref structure and their handling requires some changes to support more advanced matching of IPsec connections. No objections from reyk and hshoexer, with and OK markus.
2015-02-10bzero -> memset and unify sizeof() usage (no space).Claudio Jeker
Requested by reyk@, dlg@ and OK mpi@, henning@
2015-02-10Nuke sin_zero before passing it on down into the ifa_ifwithaddr() thatClaudio Jeker
way garbage in the pad bytes does not perturb the outcome. This fixes regress/sys/kern/bind. OK mpi@, phessler@, reyk@
2015-01-24Userland (base & ports) was adapted to always include <netinet/in.h>Theo de Raadt
before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
2014-12-17Use an interface index instead of a pointer for multicast options.Martin Pieuchot
Output interface (port) selection for multicast traffic is not done via route lookups. Instead the output ifp is registred when setsockopt(2) is called with the IP{V6,}_MULTICAST_IF option. But since there is no mechanism to invalidate such pointer stored in a pcb when an interface is destroyed/removed, it might lead your kernel to fault. Prevent a fault upon resume reported by frantisek holop, thanks! ok mikeb@, claudio@
2014-12-05Explicitly include <net/if_var.h> instead of pulling it in <net/if.h>.Martin Pieuchot
ok mikeb@, krw@, bluhm@, tedu@
2014-11-18move arc4random prototype to systm.h. more appropriate for most codeTed Unangst
to include that than rdnvar.h. ok deraadt dlg
2014-11-15use siphash in the in_pcb hashing. this mitigates it against floodingDavid Gwynne
attacks. this is a textbook use of siphash. the idea of using siphash for this came from yasuoka-san, but i had the time to do it. he also tested and tweaked this diff. ok yasuoka@ mikeb@
2014-10-28Select a proper source address when the bound address isYASUOKA Masahiko
INADDR_BROADCAST the same as INADDR_ANY. ok mpi
2014-10-14Use rtfree() instead of RTFREE(), NULLify some free'd route pointers andMartin Pieuchot
kill the macro. ok mikeb@, henning@
2014-09-27Kill rtalloc() and update rtalloc1() and rtalloc_mpath() to no longerMartin Pieuchot
rely on "struct route" that should die. ok claudio@
2014-07-22Fewer <netinet/in_systm.h> !Martin Pieuchot
2014-07-12Resize the pcb hashtable automatically. The table size will be doubledYASUOKA Masahiko
when the number of the hash entries reaches 75% of the table size. ok dlg henning, 'commit in' claudio
2014-06-04Only use ifa_ifwithaddr() to check if the binding address is on theMartin Pieuchot
system. Yes, this is ugly for the moment because OpenBSD prevents you from binding a tcp socket to broadcast address and checking for a broadcast address is... funny! If you've ever wondered why would lead people to write: ina.s_addr != ia->ia_addr.sin_addr.s_addr instead of: ina.s_addr == ia->ia_broadaddr.sin_addr.s_addr Well this is because all the IPv4 addresses belonging to your lo(4) interfaces match the second idiom. Hopefully we'll get rid of this hack soon. ok jca@, mikeb@
2014-05-07Remove the last hacks concerning the global list of IPv4 addresses in theMartin Pieuchot
source address selection logic. These hacks were only relevant for the NFS diskless boot code in order to pick the local broadcast address of the only configured interface. So, be explicit and set this address directly. Tested by florian@, ok henning@, beck@, chrisz@
2014-04-18Invert the signature logic of in{,6}_selectsrc, make them return theJeremie Courreges-Anglas
error code and pass the resulting source address back to the caller through a pointer, as suggested by chrisz. This gives us more readable code, and eases the deletion of useless checks in the callers' error path. Add a bunch of "0 -> NULL" conversions, while here. ok chrisz@ mpi@
2014-04-16Merge in_fixaddr() into in_selectsrc() in order to prepare forMartin Pieuchot
IP_SENDSRCADDR support. This reduces the differences with the IPv6 version and kill some comments that are no longer true. ok jca@, chrisz@, mikeb@
2014-04-07Retire kernel support for SO_DONTROUTE, this time without breakingMartin Pieuchot
localhost connections. The plan is to always use the routing table for addresses and routes resolutions, so there is no future for an option that wants to bypass it. This option has never been implemented for IPv6 anyway, so let's just remove the IPv4 bits that you weren't aware of. Tested a least by lteo@, guenther@ and chrisz@, ok mikeb@, benno@
2014-04-06factor out source and destination address mangling from in_pcbconnect()Christopher Zimmermann
for later reuse in udp_output(). "Apart from that OK" claudio@
2014-04-06Remove redundant call to in{,6}_pcbbind() from tcp PRU_CONNECT.Christopher Zimmermann
Make sure that in_pcbbind() is called from in_pcbconnect() by KASSERTing that local port == 0 implies an unspecified local address. OK claudio@
2014-03-28revert "Retire kernel support for SO_DONTROUTE" diff, which does bad thingsStuart Henderson
for localhost connections. discussed with deraadt@
2014-03-27Retire kernel support for SO_DONTROUTE, since the plan is to alwaysMartin Pieuchot
use the routing table there's no future for an option that wants to bypass it. This option has never been implemented for IPv6 anyway, so let's just remove the IPv4 bits that you weren't aware of. Tested by florian@, man pages inputs from jmc@, ok benno@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-30 03:37:00 +0000